Threat Hunting CAS-005 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst is tasked with proactively identifying potential threats to the organization's new cloud-based collaboration tool. The analyst wants to find publicly available information that could be used by an attacker to craft a targeted phishing campaign. Which OSINT technique would be MOST effective for this specific goal?

   • ASubscribing to a commercial threat intelligence feed to get a list of known malicious IPs targeting the cloud provider.
   • BMonitoring the company's own public DNS records to identify subdomains that might be misconfigured.
   • CSearching public job postings and social media for employee names, roles, and the specific technology stack used by the company.
   • DReviewing the source code of the company's public-facing website for comments that reveal internal IP addresses.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Why is the dark web considered a valuable source of threat intelligence?

   • AIt is the primary source of all publicly available vulnerability information
   • BIt provides real-time alerts from all major antivirus vendors
   • CIt hosts forums and marketplaces where threat actors discuss and sell exploits and stolen data
   • DIt is a government-controlled network used for official threat alerts
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security operations center (SOC) uses a SIEM platform. An analyst has identified a new attack pattern that involves a specific sequence of PowerShell commands and a connection to a known malicious IP address. The analyst wants to create a detection mechanism that will alert the SOC whenever this pattern is observed in the SIEM's log data. Which approach is MOST appropriate?

   • AWrite a YARA rule that scans the SIEM's database for the PowerShell command strings.
   • BManually search the SIEM for the pattern every day and document the results.
   • CWrite a Sigma rule that describes the log events and deploy it to the SIEM.
   • DWrite a Snort rule and deploy it to the network firewall.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   A security team deploys a honeypot that appears to be an unpatched database server. What type of intelligence can the team most directly gain from this deployment?

   • AA list of all legitimate users and their access patterns
   • BEncryption keys used by the organization's applications
   • CThe exact patch levels of all production servers
   • DInsight into attacker tools, techniques, and procedures (TTPs)
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of Snort rules?

   • ATo identify malware by scanning file contents
   • BTo provide a generic format for SIEM detection rules
   • CTo detect network intrusions by matching packet signatures and patterns
   • DTo encrypt network traffic between hosts
   Reveal Solution Discussion Select an answer first